c7n-org cannot deploy policies in multiple account same error occurring

[misumme-pg]

Ask your question

I am trying to get custodian to do this ...

@kapilt I'm having the same problem deploying c7n-org policies; I'm trying to auto tag ec2 instances in the managed account once they are launch but I'm getting same error that is mentioned. Just for the testing purpose I even gave root account and managed account role full admin permission but still getting the same error. I'm not sure what is wrong with my permission

Policy

My managed acct trust policy is as followed

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::11111111:role/custodainrole",
"Service": [
"lambda.amazonaws.com",
"ec2.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}

Policy attach is [AWSLambdaExecute], [AWSConfigRulesExecutionRole], & EC2FullAccess. And inline policy 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "lambda:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::root-account#:role/custodainrole"
        }
    ]
}

Relevant log/traceback output

running policy:cloud-custodian-auto-tag account:devops-account region:us-west-2 error:An error occurred (AccessDeniedException) when calling the CreateFunction operation: Cross-account pass role is not allowed.

[misumme-pg]

Permission

policies:

• name: cloud-custodian-auto-tag
  resource: ec2
  mode:
  type: cloudtrail
  role: arn:aws:iam::account_id#:role/AmazonSSMRoleForInstancesQuickSetup
  events:
  • RunInstances
    tags:
    custodian-info: mode=cloudtrail:version=0.9.16
    filters:
  • tag:CreatorName: absent
    actions:
  • type: auto-tag-user
    tag: CreatorName
  • type: tag
    key: backup
    value: weekly

Still getting error: I cannot get around this error even when starting from scratch

[adityagupta1982]

Did anyone manage to solve this issue? Searched the internet seems no one has a clear solution :(